The EU Cyber Resilience Act (CRA) Regulation (EU) 2024/2847 was brought in on December 10th, 2024, and will affect many digital products sold in the UK or EU within the next few years.
The CRA relates to products with digital elements (PDEs) that have, or could have, a connection to a network. If you have or are developing products that connect to the Internet, cloud or phone network, then this will affect you.
Is this serious?
The consequences for non-compliance are significant, with penalties of up to £10M or 2.5% global revenue.
It will also be difficult to retrospectively add CRA compliance to many products, so it needs to be considered now.
Under Development
While the act has been finalised, the details around its practical implementation haven’t yet been confirmed. You can be sure, though, that we will monitor information as it is released to understand its implications for your development.
Which developments will it impact?
The CRA will affect all manufacturers of products with digital elements intended for the UK/EU market unless they are specifically excluded (such as medical, automotive and aerospace, which all have separate security standards).
The affected product categories include industrial automation controls, IoT devices, smart appliances, and consumer electronics.
There are also supply chain implications, with all suppliers in your chain needing to demonstrate compliance through documentation. Integrated software must also meet CRA requirements, and there will be new documentation requirements for digital elements (CE marking).
What we know about timescales
Reporting requirements will begin on September 11th, 2026.
The full enforcement deadline is December 11th, 2027.
While current information is incomplete, we are in this with you and will support your development through this process.